FirewallScript Provides PHP-Based Protection

Trackbacks/Pings (Trackback URL)

1. Marwan
   

   April 24th, 2008 at 6:03 pm

   Amazing, just amazing.

2. Trav
   

   April 24th, 2008 at 6:04 pm

   I still think ModSecurity is better!

3. Josh
   

   April 24th, 2008 at 6:06 pm

   You’re so wrong Trav, ModSecurity is outdated, it’s nice to finally have a fresh face for those of us who need a good solution on shared hosting! This gets my vote.

4. Peter Urban
   

   April 24th, 2008 at 6:09 pm

   TechCrunch comment of firewall script 

   

   
5. Kevin
   

   April 24th, 2008 at 6:13 pm

   @4 - Technically, Techcrunch itself is on shared hosting. What if they wanted a web application firewall? Tough shit?

6. linuxamp
   

   April 24th, 2008 at 9:24 pm

   Damn, I read this article thinking, I’m gonna install this thing right now, then I got to the bottom and realized it wasn’t free. With all the comparison to modsec I kept thinking this thing was free and open source.

7. Arno
   

   April 24th, 2008 at 10:19 pm

   Wrong business model, make that open source and top it with professional commercial services, klabang there you go.

   Picking Mambo over Joomla! makes me wonder how up to date this service is.

   Arno

8. Steve
   

   April 25th, 2008 at 12:51 am

   Whilst it might look good, it wont do any good. There are many firewall packages that are complied code and run fast enough to not cause any
   overhead to the system.
   The idea to be user based config is good but it will add i guess an extra 50-100 ms to the site.

9. Scot
   

   April 25th, 2008 at 1:55 am

   After seeing this was not open source I went hunting on the web and found this:

   http://munin.xqus.com/

   

10. Richard (Aventure Host)
    

    April 25th, 2008 at 6:56 am

    As a web hosting company, we know that 99.999% of customers don’t consider the security risks contained in script installation, and for them to personally go out and purchase an $85 script, I can’t see it happening.

    If mod_security is configured correctly, with a good ruleset it ultimately provides better security (server wide instead of domain wide) than this could.

    @Josh , mod_security is based on rule sets, exactly the same as this script, so if you think that mod_security is outdated, you’ve just classed a product which runs on the same type of rules as outdated

11. Richard Harrison
    

    April 25th, 2008 at 7:20 am

    Are you kidding? An $85 script that “guarantees 100% security”.

    I’ll give away the secret of 100% protection for free: unplug your server from the internet.

    Jason, did you check out their testimonials?

    “People think my site is weird because it’s about the supernatural. But they’re out there! Sometimes the extraterrestrial see our website and try to hack it to avoid the information we reveal about them.”

12. bannerreviews.com
    

    April 25th, 2008 at 8:13 am

    While the company says this is great for shared web hosting environments, I wonder what kind of load it would generate for each and every page view, in addition to regular page loads.

    You also have to put a ‘copyright’, or notice on your page saying you use the product, which is just inviting trouble.

13. Kevin
    

    April 25th, 2008 at 10:33 am

    @10 - How can Modsec be used with tight rules, when the admin cant control whats on his server? You cant globally disallow the word “Javascript” in the URL bar, because some legit scripts might use it. With this software, the admin knows exactly what he has, and can narrow down security to be much tighter than a server admin could, hence why it beats modsec in many areas. Modsec has to be vague and general (Especially on shared hosting) or it would cause so many errors with users installed scripts it wouldnt be funny. This does not.

14. Richard
    

    April 25th, 2008 at 1:35 pm

    So users are expected to know what coding elements aren’t used in the scripts that are installed so they can add them in to the firewall php script?

    I’ve set to see a single exploit attempt in the last 6 years which uses the term ‘javascript’ in the URL bar, I think that’s a poor example. Anyone who developers their own scripts can block certain terms from being used in the URL bar with suitable coding, they don’t need to fork out $85 for it.

    I personally still don’t see why TC covered this, there’s better PHP scripts developed every minute of the day.